REMARKS 



Claims 10 and 18-20 have been cancelled. Claims 1 and 14-17 have been amended to 
clarify the subject matter regarded as the invention. Claims 1-9 and 1 1-17 are pending. 

The Examiner has rejected claims 1-9 and 1 1-17 under 35 USC 103(a) as being 
unpatentable over Taj alii in view of Shah. 

The rejection is respectfully traversed. With respect to claims 1,16, and 17 each has 
been amended to clarify that the normal and permitted "first behavior" of the monitored process 
is determined by parsing a file created by the monitored process itself and used by the 
monitoring process in normal operation to access one or more resources. Tajalli teaches a 
"behavior control description" created not by parsing a file created and used by a monitored 
process but instead included in a firewall as provided by the firewall vendor or created by third 
party "software vendors" or "consulting organizations". Tajalli at [0045], [0052]. Shah 
describes learning an allowed behavior by observing a process in a controlled environment, not 
parsing a file created and used by a monitored process to determine one or more resources 
accessed by the monitored process in the course of such a normal operation. Shah, col. 33, lines 
10-46. Monitoring the behavior of a process in a controlled environment and noting the 
resources it accesses is not the same as parsing a file created and used by such a process during a 
normal and permitted operation to determine such resources, as recited in claims 1,16, and 17. 
Using the approach recited in claims 1, 16, and 17, the resources accessed by the monitored 
process in the course of the normal and permitted operation (first behavior) can be learned 
"without requiring a running instance of the process," as taught by applicants at page 6, lines 7-9. 
Therefore, claims 1,16, and 17 are believed to be allowable. 

Claims 2-9 and 11-15 depend from claim 1 and are believed to be allowable for the same 
reasons described above. 

The foregoing amendments are not to be taken as an admission of unpatentability of any 
of the claims prior to the amendments. 
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Reconsideration of the application and allowance of all claims are respectfully requested 
based on the preceding remarks. If at any time the Examiner believes that an interview would be 
helpful, please contact the undersigned. 

Respectfully submitted, 



Dated: 

William J. James 
Registration No. 40,661 
V 408-973-2592 
F 408-973-2595 



VAN PELT, YI & JAMES LLP 
10050 N. Foothill Blvd., Suite 200 
Cupertino, CA 95014 
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